Hi, I found an other minor bug in ttls implementation In configuration where Freeradius proxyies tunneled ttls message to a home server Radius, FreeRadius doesn't send good message after having received Access-Reject/EAP-Failure from radius home server. Indeed, FreeRadius sends to the NAS an Access-Reject but doesn't include EAP/Failure attribute. This is the same case if an unknown Radius message is received from the radius home server. So the peer isn't informed of this decision and retransmits his last request after its watchdog wakes up. Here are the modifications I done on my server to correct the bug. ttls.c v1.20 process_reply function : l712 : I replaced "rcode=RLM_MODULE_REJECT" by "rcode=RLM_MODULE_INVALID" --> Invalid message and Rejected Message wasn't differentiated eap_ttls_postproxy function : l819 : replace "return 0" by "break" --> So eaptls_fail of l839 can be called to add EAP/FAILURE message in case of RLM_MODULE_REJECT rlm_eap.c v1.30 eap_post_proxy function : l547 : I moved "rcode = eap_compose(handler)" to l538 and I removed "rcode =" --> With this modification eap_compose is called whatever the return code and the eap attribute can be inserted even if the message is rejected Fabien Marotte
No difference in configuration Just an other bug Fabien Marotte
<fabien.marotte@freesurf.fr> wroteL
In configuration where Freeradius proxyies tunneled ttls message to a home server Radius, FreeRadius doesn't send good message after having received Access-Reject/EAP-Failure from radius home server.
Ok... diffs?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Hello Fabien. Dne petek 03 junij 2005 10:32 je fabien.marotte@freesurf.fr napisal(a):
<fabien.marotte@freesurf.fr> wroteL
In configuration where Freeradius proxyies tunneled ttls message to a home server Radius, FreeRadius doesn't send good message after having received Access-Reject/EAP-Failure from radius home server.
Ok... diffs?
Alan DeKok.
No difference in configuration Just an other bug
Actualy Alan is asking for a diff/patch file. The diff file is produced by running diff -u ./fixed-version/file.c ./original-version/file.c >> my_lovely_patch.diff It is a general rule in open-source world that you provide a diff file when trying to communicate over the changes you made to the source file. -- Best regards, Rok Papez <rok.papez@arnes.si> ARNES - Academic and Research NEtwork of Slovenia http://www.arnes.si Jamova 39 p.p. 7, SI-1001 Ljubljana, Slovenia tel: +386 1 479 88 00, fax: +386 1 479 88 78
I'm sorry, I didn't understand. Thanks Rok So I join the two diffs files. patch for ttls.c v1.21 patch for rlm_eap.c v1.30 Fabien Marotte
Dne petek 03 junij 2005 13:38 je Rok Papez napisal(a):
Correction:
diff -u ./fixed-version/file.c ./original-version/file.c >> my_lovely_patch.diff diff -u ./original-version/file.c ./fixed-version/file.c >> my_lovely_patch.diff
-- lep pozdrav, Rok Pape¾.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
<fabien.marotte@freesurf.fr> wrote:
So I join the two diffs files. patch for rlm_eap.c v1.30
Ok. I haven't applied the patch as-is. Instead, if the callback returns 0, we now call eap_fail(handler), which should have the same result. I think that should be sufficient.
patch for ttls.c v1.21
Applied, thanks. Alan DeKok.
participants (3)
-
Alan DeKok -
fabien.marotte＠freesurf.fr -
Rok Papez